cfn-lint icon indicating copy to clipboard operation
cfn-lint copied to clipboard

Detect invalid regexes in AllowedPattern property of parameters

Open trav-c opened this issue 4 years ago • 2 comments

cfn-lint version: (cfn-lint --version) cfn-lint 0.32.1

Description of issue. cfn-lint currently does not appear to validate that the contents of the AllowedPattern property of a template parameter contains a valid regular expression when present, it would be useful if cfn-lint could check this.

For example a template containing:

Parameters:
    MyTestParameter:
        Description: Test with invalid AllowedPattern
        Type: String
        AllowedPattern: '^abc|def)$'
        ConstraintDescription: Must match AllowedPattern

Is not currently flagged by cfn-lint, but is rejected at runtime by CloudFormation due to the invalid regular expression in the AllowedPattern property which is missing a '(' at the second character.

trav-c avatar Jun 03 '20 01:06 trav-c

CloudFormation uses java.util.regex.Pattern for regex parsing.

There will be some cases where the regex expressions do not evaluate to the same thing in Python in Java (which does not matter for this purpose), but I think some research needs to be done to check whether or not there are cases where an expression may considered valid in Python and not in Java and vice versa

dontirun avatar Jul 24 '20 14:07 dontirun

similar to discussion here as well: https://github.com/aws-cloudformation/cloudformation-cli/pull/675#discussion_r566298712 Ideally patterns stick to a regular expression syntax subset valid in both Python and Java, but there are patterns invalid in Python that would be valid in Java

PatMyron avatar Nov 02 '21 20:11 PatMyron